Organization should have data processing agreements with all processors
Critical
Cross-cloud
General
manual-gdpr-processor-agreements
How to fix it
Ensure written data processing agreements (DPAs) are in place with all data processors per Article 28. Include subject matter, duration, nature, purpose, types of data, categories of data subjects, and obligations.
How to verify
- Verify DPA inventory for all processors
- Confirm all DPAs include Article 28 required provisions
- Verify processor audit rights are documented
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related Cross-cloud rules
- Block storage volumes must be encrypted
- Cache service security hardening
- Cache services must enforce TLS encryption in transit
- Container registry security hardening
- Database authentication must use managed identities
- Databases must not be publicly accessible
- IAM password policy must require minimum length of 14
- Key management service security hardening